How to avoid Windows (Vista) to do "double" webdav requests

Question

We use DIGEST authentication for our WebDAV Access. We observe that Windows clients send each request twice. First request doesn't have Authorization header (and gets 401 response), second request has Authorization header (and usually gets correct response).

While user probably cannot see this, it makes whole Webdav access slower then necessary.

Is it possible to avoid this behaviour somehow? Maybe some special response which will convince Windows not to do this? When we use BASIC instead of DIGEST, it works fine (doing single request only with Authorization header always included)

Answer 1

I believe that the method you described, which is called a "challenge / response" method, is the intended behavior for WebDAV. At least it is according to the specs. That first request without auth headers is necessary; the response from WebDAV contains a nonce to validate the next request, helping deflect against, for example, replay attacks.

So, bottom line: you can't, and shouldn't try to avoid this behavior.

As to your non-Windows clients that are doing this... it's possible that they're caching and reusing the nonce in some way after an initial challenge / response call. This is certainly allowed in the specs -- even though the nonce is supposed to be a single-use item, the specs allow WebDAV servers to make the nonce short-lived across multiple requests. It's possible that your non-Windows clients are able to recognize your WebDAV server and act accordingly but the Windows clients are not.

In that case, I don't know of a work around other than to ask users to find a client that caches a nonce. Unfortunately, I cannot help you find such a client. My Google-fu has failed in that regard.

Answer 2

You can also research something called "Preauthentication". Preauthentication is sending the first request with an authentication header as opposed to sending an inital anonymous request.

While applications and web services are ideal for this since you typically know beforehand whether authentication is required, you typically don't know if a web site requires authentication beforehand.

WebFolders/WebDAV is a special case, but again, you're not sure.

The issue with preauthentication is that you are potentially sending information to a site that you don't necessarily trust. Basic Authentication would give away the keys to the kingdom (User/password in plain text), however Negotiate, NTLM and Digest aren't so bad.

You can take a look here on preauthenticating in .Net for a web service, which I have used successfully eliminate the initial 401.

Answer 3

If you are struggeling with the Windows WebFolder Client you might want to have a look at this issues list hosted at the greenbytes WebDav site. If you noticed any Vista specific details not contained in the list, please send a note to the editors.